The 4 Tiers of VPNs:
🟢 Tier 1 — Easy to identify
WireGuard, OpenVPN/UDP, IKEv2, L2TP. Fast and simple, but have clear packet signatures. Fine on most networks, first to get filtered where traffic gets inspected.
🟡 Tier 2 — TLS-wrapped, still fingerprintable
OpenVPN/TCP, SOCKS proxies. Looks like HTTPS at a glance, but the handshakes have quirks that distinguish them from real browsers.
🟠 Tier 3 — Camouflaged as web traffic
Shadowsocks, OpenConnect, OpenVPN+XOR, SoftEther. Blends in well against simple inspection. More advanced detection (entropy analysis, active probing) can still spot them.
🔴 Tier 4 — Indistinguishable from web traffic
v2ray, VLESS, wstunnel, Cloak. Not VPNs themselves — mimicry layers you bolt onto a tunnel. Cloak even serves a real "donor" website to anyone probing your server 🎭
The takeaway: run more than one. WireGuard for speed, a Tier 3/4 stack as a fallback.
Read more 👉 https://www.doprax.com/blog/self-hosted-vpns-how-they-work-and-why-the-protocol-you-choose-matters
🟢 Tier 1 — Easy to identify
WireGuard, OpenVPN/UDP, IKEv2, L2TP. Fast and simple, but have clear packet signatures. Fine on most networks, first to get filtered where traffic gets inspected.
🟡 Tier 2 — TLS-wrapped, still fingerprintable
OpenVPN/TCP, SOCKS proxies. Looks like HTTPS at a glance, but the handshakes have quirks that distinguish them from real browsers.
🟠 Tier 3 — Camouflaged as web traffic
Shadowsocks, OpenConnect, OpenVPN+XOR, SoftEther. Blends in well against simple inspection. More advanced detection (entropy analysis, active probing) can still spot them.
🔴 Tier 4 — Indistinguishable from web traffic
v2ray, VLESS, wstunnel, Cloak. Not VPNs themselves — mimicry layers you bolt onto a tunnel. Cloak even serves a real "donor" website to anyone probing your server 🎭
The takeaway: run more than one. WireGuard for speed, a Tier 3/4 stack as a fallback.
Read more 👉 https://www.doprax.com/blog/self-hosted-vpns-how-they-work-and-why-the-protocol-you-choose-matters
This media is not supported in your browser
VIEW IN TELEGRAM
We’re now offering Google Cloud!
Which means: you can have the power of one of the largest fiber networks in the world, but without the complexity. Deploy AI agents, scale up as high as you want, be local everywhere (43 new locations).
Request early access via the Doprax dashboard:
https://www.doprax.com/v/virtual-machines/new
Which means: you can have the power of one of the largest fiber networks in the world, but without the complexity. Deploy AI agents, scale up as high as you want, be local everywhere (43 new locations).
Request early access via the Doprax dashboard:
https://www.doprax.com/v/virtual-machines/new
Did you know that you can easily create a Doprax app for your phone? Useful if you want to check in on your deployments every now and then.
🍏 For iPhone (Safari):
• Open Safari and go to doprax.com.
• Tap the Share icon (the square with an up arrow at the bottom).
• Scroll down and select "Add to Home Screen."
• Name it "Doprax" and tap Add.
🤖 For Android (Chrome):
• Open Chrome and head to doprax.com.
• Tap the three dots (⋮) in the top right corner.
• Select "Install app" or "Add to Home screen."
• Confirm by tapping Install/Add.
🍏 For iPhone (Safari):
• Open Safari and go to doprax.com.
• Tap the Share icon (the square with an up arrow at the bottom).
• Scroll down and select "Add to Home Screen."
• Name it "Doprax" and tap Add.
🤖 For Android (Chrome):
• Open Chrome and head to doprax.com.
• Tap the three dots (⋮) in the top right corner.
• Select "Install app" or "Add to Home screen."
• Confirm by tapping Install/Add.
npm supply-chain worm hits 169+ packages.
The Mini Shai-Hulud worm (TeamPCP) compromised TanStack Router, UiPath, Mistral AI, Guardrails AI, and 165+ other npm packages. 373 malicious versions.
It hijacks CI/CD via GitHub Actions cache poisoning, steals credentials, and installs a daemon polling GitHub every 60s. If the daemon sees a revoked token, it runs rm -rf ~/. Cleanup order matters.
Running Node.js on a Doprax VM:
1. npm ls | grep -E '@tanstack|@uipath|@mistralai|guardrails'
2. npm audit
3. If hit: stop gh-token-monitor BEFORE rotating tokens
4. Wipe node_modules, reinstall with --ignore-scripts
5. Rotate every credential that touched the VM
Prevention: pnpm 11 defaults (minimumReleaseAge: 1440, blockExoticSubdeps, no install scripts) would have blocked this.
Isolated VMs keep the blast radius at one machine. Core Doprax is unaffected.
Full guide: https://www.doprax.com/blog/an-npm-worm-is-spreading-heres-what-to-do-if-you-run-node-on-doprax
The Mini Shai-Hulud worm (TeamPCP) compromised TanStack Router, UiPath, Mistral AI, Guardrails AI, and 165+ other npm packages. 373 malicious versions.
It hijacks CI/CD via GitHub Actions cache poisoning, steals credentials, and installs a daemon polling GitHub every 60s. If the daemon sees a revoked token, it runs rm -rf ~/. Cleanup order matters.
Running Node.js on a Doprax VM:
1. npm ls | grep -E '@tanstack|@uipath|@mistralai|guardrails'
2. npm audit
3. If hit: stop gh-token-monitor BEFORE rotating tokens
4. Wipe node_modules, reinstall with --ignore-scripts
5. Rotate every credential that touched the VM
Prevention: pnpm 11 defaults (minimumReleaseAge: 1440, blockExoticSubdeps, no install scripts) would have blocked this.
Isolated VMs keep the blast radius at one machine. Core Doprax is unaffected.
Full guide: https://www.doprax.com/blog/an-npm-worm-is-spreading-heres-what-to-do-if-you-run-node-on-doprax
GitHub breach. Same crew as last week's npm worm.
GitHub confirmed unauthorized access to its internal repositories. A poisoned VS Code extension on an employee device, ~3,800 internal repos exfiltrated. No evidence yet of impact to customer enterprises, organizations, or repos.
Attribution: TeamPCP. The same group behind the Mini Shai-Hulud npm worm that hit TanStack, UiPath, Mistral AI, and 165+ other packages on May 11.
If you run code on a Doprax VM and use GitHub:
→ Rotate GitHub PATs, OAuth tokens, Actions secrets
→ Audit VS Code extensions installed on your dev machines
→ Review recent repo activity for anything you didn't push
GitHub rotated its critical secrets overnight. Downstream systems should follow.
Two TeamPCP attacks in nine days, both targeting developer tooling. The pattern is clear: registries, extensions, CI runners. Treat each install like the privileged operation it is.
GitHub confirmed unauthorized access to its internal repositories. A poisoned VS Code extension on an employee device, ~3,800 internal repos exfiltrated. No evidence yet of impact to customer enterprises, organizations, or repos.
Attribution: TeamPCP. The same group behind the Mini Shai-Hulud npm worm that hit TanStack, UiPath, Mistral AI, and 165+ other packages on May 11.
If you run code on a Doprax VM and use GitHub:
→ Rotate GitHub PATs, OAuth tokens, Actions secrets
→ Audit VS Code extensions installed on your dev machines
→ Review recent repo activity for anything you didn't push
GitHub rotated its critical secrets overnight. Downstream systems should follow.
Two TeamPCP attacks in nine days, both targeting developer tooling. The pattern is clear: registries, extensions, CI runners. Treat each install like the privileged operation it is.
In many cases having the “best” VPN (like VLESS + REALITY) won’t save you from being flagged or blocked. Which means the real skill is flexibility: portable config, more than one node, a clean IP you can spin up in under a minute.
Full breakdown, plus what a resilient setup actually looks like:
https://www.doprax.com/blog/why-one-vpn-protocol-isnt-enough
Full breakdown, plus what a resilient setup actually looks like:
https://www.doprax.com/blog/why-one-vpn-protocol-isnt-enough
Hetzner is increasing their prices starting June 15. They’ve not published any numbers yet. Keep an eye on your Doprax dashboard, and we’ll bring you the latest news when we have them.
What’s going on & what you should do before June 15: https://www.doprax.com/blog/hetzner-is-changing-their-server-lineup-increasing-the-prices
What’s going on & what you should do before June 15: https://www.doprax.com/blog/hetzner-is-changing-their-server-lineup-increasing-the-prices
MikroTik is now on ProVM.
You can deploy a full MikroTik Cloud Hosted Router (CHR) on a Doprax VM in under a minute. Same RouterOS you'd run on a physical MikroTik box, running in the cloud.
What you can do with it:
→ Firewall for your cloud servers
→ VPN server (WireGuard, OpenVPN, L2TP, IPsec)
→ Bandwidth management and traffic shaping
→ HTTP proxy with domain filtering
→ Route traffic between sites
Pick MikroTik as the image source when you create a ProVM. Version 7.17, available now.
One thing to know: CHR's free license caps speed at 1 Mbps. Grab the 60-day trial or a P1 license from your MikroTik.com account to unlock full throughput. We'll have a setup guide up shortly.
Full guide: https://www.doprax.com/docs/how-to-deploy-a-mikrotik-cloud-hosted-router-on-a-doprax-vm
You can deploy a full MikroTik Cloud Hosted Router (CHR) on a Doprax VM in under a minute. Same RouterOS you'd run on a physical MikroTik box, running in the cloud.
What you can do with it:
→ Firewall for your cloud servers
→ VPN server (WireGuard, OpenVPN, L2TP, IPsec)
→ Bandwidth management and traffic shaping
→ HTTP proxy with domain filtering
→ Route traffic between sites
Pick MikroTik as the image source when you create a ProVM. Version 7.17, available now.
One thing to know: CHR's free license caps speed at 1 Mbps. Grab the 60-day trial or a P1 license from your MikroTik.com account to unlock full throughput. We'll have a setup guide up shortly.
Full guide: https://www.doprax.com/docs/how-to-deploy-a-mikrotik-cloud-hosted-router-on-a-doprax-vm
It’s official: Hetzner prices are up to 36% higher now. The good news: ProVM prices remain the same, so now is a good time to switch to ProVM.
Read more here: https://www.doprax.com/blog/hetzner-just-raised-prices-by-up-to-36-provm-didnt
PS: We’re currently syncing our system against the new Hetzner prices, so for a short time you won’t see “Hetzner” in the list of providers when creating a new VM. Updates coming up!
Read more here: https://www.doprax.com/blog/hetzner-just-raised-prices-by-up-to-36-provm-didnt
PS: We’re currently syncing our system against the new Hetzner prices, so for a short time you won’t see “Hetzner” in the list of providers when creating a new VM. Updates coming up!
We’re always working on improving our systems and your experience. The most valuable feedback comes from our users, so we want to know what you think. What’s missing, what would you like to improve?
Take a look at our anonymous survey (you can reply in any language): https://docs.google.com/forms/d/e/1FAIpQLScSlPQl7Agr-NsnoUP9UqQefi9IN7jxxl_u1jro3LbVy9guEQ/viewform
Take a look at our anonymous survey (you can reply in any language): https://docs.google.com/forms/d/e/1FAIpQLScSlPQl7Agr-NsnoUP9UqQefi9IN7jxxl_u1jro3LbVy9guEQ/viewform
We’ve launched the ProVM Turbo tier! ⚡️
3Gbps port speed, advanced 2026 CPU and high speed RAM / disk.
You can spin up a more powerful ProVM now via your Doprax dashboard:
https://www.doprax.com/v/virtual-machines
3Gbps port speed, advanced 2026 CPU and high speed RAM / disk.
You can spin up a more powerful ProVM now via your Doprax dashboard:
https://www.doprax.com/v/virtual-machines
Psiphon Conduit can be super helpful when you need reliable access to the open web. The nodes are run by volunteers and they can keep thousands of users connected simultaneously.
Each node is just a VPS running a Docker container, forwarding encrypted packets.
Here's how to run one on a ProVM:
https://www.doprax.com/docs/run-a-psiphon-conduit-node-on-a-doprax-provm
Each node is just a VPS running a Docker container, forwarding encrypted packets.
Here's how to run one on a ProVM:
https://www.doprax.com/docs/run-a-psiphon-conduit-node-on-a-doprax-provm
3x-ui or Marzban? People argue features, but those barely differ.
Both run on Xray-core, both do VLESS and Reality, both give you a dashboard, traffic stats, and a Telegram bot.
The real question is: how many users are you serving?
One server and a handful of users, run 3x-ui. It's a single Go binary, light on memory, up in minutes, and simple enough that you won't fight it.
Many users, or servers in more than one location, run Marzban. Real database, full API, and one panel that controls multiple nodes, so a user connects through any of them on the same subscription link.
That's the whole decision. Small and simple, 3x-ui. Large and multi-server, Marzban.
Full breakdown, including where 3x-ui starts to strain and why: https://www.doprax.com/blog/3x-ui-or-marzban-pick-by-how-many-servers-you-run
Both run on Xray-core, both do VLESS and Reality, both give you a dashboard, traffic stats, and a Telegram bot.
The real question is: how many users are you serving?
One server and a handful of users, run 3x-ui. It's a single Go binary, light on memory, up in minutes, and simple enough that you won't fight it.
Many users, or servers in more than one location, run Marzban. Real database, full API, and one panel that controls multiple nodes, so a user connects through any of them on the same subscription link.
That's the whole decision. Small and simple, 3x-ui. Large and multi-server, Marzban.
Full breakdown, including where 3x-ui starts to strain and why: https://www.doprax.com/blog/3x-ui-or-marzban-pick-by-how-many-servers-you-run
If you connect your locally running Claude Code to a Doprax VM, you can use plain language to control any processes running on it. For example:
→ "Add a WireGuard peer for my phone" and get the config back in the same message.
→ "Check how many users are live on 3x-ui" instead of opening the panel.
→ "Restart the Marzban node and confirm the API's back up" while you do something else.
→ "Something's wrong with nginx, check the logs" instead of grepping through them yourself.
Full walkthrough: https://www.doprax.com/tutorial/use-claude-code-on-your-laptop-to-manage-a-doprax-provm
→ "Add a WireGuard peer for my phone" and get the config back in the same message.
→ "Check how many users are live on 3x-ui" instead of opening the panel.
→ "Restart the Marzban node and confirm the API's back up" while you do something else.
→ "Something's wrong with nginx, check the logs" instead of grepping through them yourself.
Full walkthrough: https://www.doprax.com/tutorial/use-claude-code-on-your-laptop-to-manage-a-doprax-provm
How to spot a fake VPN
Free VPN apps make one promise: your traffic stays private. But can you trust just about any third-party VPN provider?
Running servers costs money. If the app is free and has no published audit, someone else is paying for your data.
Check these five things before you install a VPN app:
1. Is there a real audit from an outside company? Or just a claim?
2. Can you find the company behind the app? A name, an address, a real business?
3. Does the app ask for permissions it doesn't need, like your contacts or location?
4. Does it tell you which protocol it uses (WireGuard, OpenVPN)? Or does it hide behind words like "proprietary encryption"?
5. How many real server locations does it have? Some apps show many countries but use only two or three real servers.
In case of doubt, run your own VPN. Full post here: https://www.doprax.com/blog/how-to-spot-a-fake-vpn
Free VPN apps make one promise: your traffic stays private. But can you trust just about any third-party VPN provider?
Running servers costs money. If the app is free and has no published audit, someone else is paying for your data.
Check these five things before you install a VPN app:
1. Is there a real audit from an outside company? Or just a claim?
2. Can you find the company behind the app? A name, an address, a real business?
3. Does the app ask for permissions it doesn't need, like your contacts or location?
4. Does it tell you which protocol it uses (WireGuard, OpenVPN)? Or does it hide behind words like "proprietary encryption"?
5. How many real server locations does it have? Some apps show many countries but use only two or three real servers.
In case of doubt, run your own VPN. Full post here: https://www.doprax.com/blog/how-to-spot-a-fake-vpn
Good news!
We’ve been improving our infrastructure quality and IP availability. What’s new:
1. We’re doubling down on internal IP monitoring to ensure that any IPs assigned to servers are fully functional.
2. There’s now a full new IP range on Hetzner.
Recent updates have reduced IP-related issues significantly, and we are working closely with our infrastructure partners to further improve reliability and connectivity across all locations.
Next up is ProVM. We're working on more improvements there for consistent performance across all regions (PS: try ProVM Turbo, our new high-end range of VMs).
Read in full: https://www.doprax.com/blog/how-were-improving-ip-quality-across-doprax
Do you have improvement suggestions? Let your voice be heard: https://docs.google.com/forms/d/e/1FAIpQLScSlPQl7Agr-NsnoUP9UqQefi9IN7jxxl_u1jro3LbVy9guEQ/viewform
We’ve been improving our infrastructure quality and IP availability. What’s new:
1. We’re doubling down on internal IP monitoring to ensure that any IPs assigned to servers are fully functional.
2. There’s now a full new IP range on Hetzner.
Recent updates have reduced IP-related issues significantly, and we are working closely with our infrastructure partners to further improve reliability and connectivity across all locations.
Next up is ProVM. We're working on more improvements there for consistent performance across all regions (PS: try ProVM Turbo, our new high-end range of VMs).
Read in full: https://www.doprax.com/blog/how-were-improving-ip-quality-across-doprax
Do you have improvement suggestions? Let your voice be heard: https://docs.google.com/forms/d/e/1FAIpQLScSlPQl7Agr-NsnoUP9UqQefi9IN7jxxl_u1jro3LbVy9guEQ/viewform
Claude Code & Your VM: When It’s Especially Useful
Some server tasks are faster to do by hand. Others are easier if you let Claude Code do them for you.
IIf you run WireGuard, 3x-ui, or Marzban, you'll hit the second case more often than you think:
→ Two inbounds look the same. One works, one doesn't. Instead of checking both by hand, ask Claude Code to compare the configs and the logs.
→ Some WireGuard peers haven't connected in a week, and you didn't notice.
→ Rotating a cert means changing three files and restarting things in the right order. Easy to make a mistake late at night.
This doesn't mean you stop knowing your own setup. Claude Code still shows you every command before it runs. It just saves you from checking three log files by hand, one by one.
See more examples here: https://www.doprax.com/tutorial/claude-code-your-vm-practical-use-cases
Some server tasks are faster to do by hand. Others are easier if you let Claude Code do them for you.
IIf you run WireGuard, 3x-ui, or Marzban, you'll hit the second case more often than you think:
→ Two inbounds look the same. One works, one doesn't. Instead of checking both by hand, ask Claude Code to compare the configs and the logs.
→ Some WireGuard peers haven't connected in a week, and you didn't notice.
→ Rotating a cert means changing three files and restarting things in the right order. Easy to make a mistake late at night.
This doesn't mean you stop knowing your own setup. Claude Code still shows you every command before it runs. It just saves you from checking three log files by hand, one by one.
See more examples here: https://www.doprax.com/tutorial/claude-code-your-vm-practical-use-cases
Running your own V2Ray server is only half the setup. The other half is getting your phone or laptop to actually use it.
If you're on iPhone or Mac, V2Box is a clean way to do that. Scan a QR code from your panel, tap connect, done.
→ Works with VMess, VLESS, and Trojan
→ Supports Reality and uTLS on the client side
→ Merges Wi-Fi and cellular for a more stable connection
→ Can share the tunnel locally over SOCKS5/HTTP for other devices
Full walkthrough here: https://www.doprax.com/tutorial/connect-to-your-provm-v2ray-server-from-iphone-or-mac-with-v2box
If you're on iPhone or Mac, V2Box is a clean way to do that. Scan a QR code from your panel, tap connect, done.
→ Works with VMess, VLESS, and Trojan
→ Supports Reality and uTLS on the client side
→ Merges Wi-Fi and cellular for a more stable connection
→ Can share the tunnel locally over SOCKS5/HTTP for other devices
Full walkthrough here: https://www.doprax.com/tutorial/connect-to-your-provm-v2ray-server-from-iphone-or-mac-with-v2box
Ubuntu, Debian, or Fedora for your next server? The answer depends on what you're optimizing for.
→ Ubuntu Server: widest docs and compatibility, 5 years of support, the safe default
→ Debian Server: leanest base, no Snap, ideal for small VMs running one or two services
→ Fedora Server: newest packages, but a ~13 month clock before you need to upgrade
→ AlmaLinux / Rocky Linux: RHEL-compatible, ~10 year lifecycle, no subscription needed
→ CentOS Stream: a rolling preview of RHEL, built for testing, not for a box you forget about
Full breakdown with a quick decision table: https://www.doprax.com/blog/ubuntu-server-vs-debian-server-vs-fedora-server
→ Ubuntu Server: widest docs and compatibility, 5 years of support, the safe default
→ Debian Server: leanest base, no Snap, ideal for small VMs running one or two services
→ Fedora Server: newest packages, but a ~13 month clock before you need to upgrade
→ AlmaLinux / Rocky Linux: RHEL-compatible, ~10 year lifecycle, no subscription needed
→ CentOS Stream: a rolling preview of RHEL, built for testing, not for a box you forget about
Full breakdown with a quick decision table: https://www.doprax.com/blog/ubuntu-server-vs-debian-server-vs-fedora-server